@agfpd/iapeer 0.4.36 → 0.4.37

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.36",
+  "version": "0.4.37",
   "description": "Run Claude Code and Codex CLI as local background agents that message each other, wake on demand, and share one memory.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/daemon/main.ts

@@ -547,6 +547,25 @@ if (import.meta.main) {
     }
     process.on('SIGTERM', shutdown)
     process.on('SIGINT', shutdown)
+    // В5 — a NON-signal crash (an unhandledRejection, or any uncaught error) would otherwise kill the
+    // daemon WITHOUT running handle.close() → failAll, so in-memory composer-queued messages (the sender
+    // already got queued:true) would vanish SILENTLY — the forbidden loss class. Run failAll on these
+    // paths too so senders are notified, then exit(1) so launchd KeepAlive respawns a clean daemon. A
+    // bounded timeout guarantees the exit even if close() hangs. (Hard SIGKILL/OOM cannot be caught — a
+    // durable on-disk composer queue would be needed for that, a deliberate follow-up.)
+    let crashing = false
+    const crashExit = (kind: string) => (errObj: unknown) => {
+      if (crashing) return
+      crashing = true
+      const detail = errObj instanceof Error ? (errObj.stack ?? errObj.message) : String(errObj)
+      process.stderr.write(`[iapeer-daemon] ${kind} — failing pending queued deliveries then exiting: ${detail}\n`)
+      const done = (): never => process.exit(1)
+      const t = setTimeout(done, 3000)
+      if (typeof t.unref === 'function') t.unref()
+      void handle.close().then(done, done)
+    }
+    process.on('uncaughtException', crashExit('uncaughtException'))
+    process.on('unhandledRejection', crashExit('unhandledRejection'))
     await new Promise(() => {}) // launchd KeepAlive holds this process; block forever
   }
 }

package/src/lifecycle/index.ts

@@ -727,6 +727,12 @@ export async function withWakeLock<T>(
     stale: 60_000,
     update: 5_000,
     retries: { retries: cfg.wakeLockRetries, factor: 1.3, minTimeout: 100, maxTimeout: 1_000 },
+    // В5 — a compromised wake-lock (mtime-refresh timer fired late, e.g. after system sleep >60s) MUST
+    // NOT rethrow from proper-lockfile's timer: unhandled it crashes the whole router and silently drops
+    // the in-memory composer queue. Log and continue — a controlled degrade beats killing the daemon.
+    onCompromised: (err: Error) => {
+      process.stderr.write(`[iapeer] WARN wake-lock compromised for ${identity} (continuing, not crashing): ${err.message}\n`)
+    },
   })
   try {
     return await fn()

package/src/registry/index.ts

@@ -297,6 +297,13 @@ export async function withPeersLock<T>(
     stale: 10_000,
     update: 1_000,
     retries: { retries: 13, factor: 1.4, minTimeout: 50, maxTimeout: 500 },
+    // В5 — a compromised lock (e.g. the mtime-refresh timer fired late after system sleep, so the lock
+    // read as stale) MUST NOT rethrow from proper-lockfile's timer: unhandled, it would crash the whole
+    // router process and silently drop the in-memory composer queue. Log loudly and let the current
+    // (near-done) critical section finish — a controlled degrade beats taking the daemon down.
+    onCompromised: (err: Error) => {
+      process.stderr.write(`[iapeer] WARN peers-lock compromised (continuing, not crashing): ${err.message}\n`)
+    },
   })
   try {
     return await fn(paths)

package/src/transport/index.ts

@@ -1025,7 +1025,17 @@ export function createComposerDeliveryQueue(opts: ComposerDeliveryQueueOptions):
   function kick(identity: string): void {
     if (draining.has(identity)) return
     draining.add(identity)
-    void drain(identity).finally(() => draining.delete(identity))
+    void drain(identity)
+      .catch(() => {
+        /* drain is internally best-effort; a stray throw must not surface as an unhandled rejection */
+      })
+      .finally(() => {
+        draining.delete(identity)
+        // В9 — close the enqueue-during-teardown race: a job pushed AFTER drain's empty-return but
+        // BEFORE this finally cleared `draining` saw kick() no-op (draining still held), leaving it
+        // undrained until some unrelated later enqueue. Re-kick if work remains so it drains promptly.
+        if (queues.get(identity)?.length) kick(identity)
+      })
   }
 
   async function drain(identity: string): Promise<void> {
@@ -1050,8 +1060,20 @@ export function createComposerDeliveryQueue(opts: ComposerDeliveryQueueOptions):
         continue
       }
 
-      const delivered = await deliver(job.target, job.envelope, job.peer.cwd)
+      // В8 — take the head OUT of the queue BEFORE committing to deliver. A concurrent failAll snapshots
+      // only what remains queued, so an IN-FLIGHT job is never both delivered AND failed (the dup / false-
+      // failure the exactly-once contract forbids). The head stayed queued during the composer poll-wait
+      // above (still undelivered → failAll correctly fails it); it leaves the queue only at this commit.
       q.shift()
+      let delivered: Result<void>
+      try {
+        delivered = await deliver(job.target, job.envelope, job.peer.cwd)
+      } catch (e) {
+        // deliverWarm normally returns a Result, but a defensive catch keeps drain from throwing (which,
+        // with the В9 re-kick, could otherwise spin) — an unexpected throw is a delivery failure.
+        await notifyFailed(job, `queued delivery to ${job.target.personality} (${job.target.runtime}) failed: ${e instanceof Error ? e.message : String(e)}`)
+        continue
+      }
       if (!delivered.ok) {
         await notifyFailed(job, `queued delivery to ${job.target.personality} (${job.target.runtime}) failed: ${delivered.error.message}`)
       } else {